WordPress hardening, checked on every site, every day
You know the WordPress hardening rules. The problem is knowing which of your sites still follow them, after migrations, host moves and work by other developers.
A `wp-config.php` changes more often than you think.
A colleague turns on debugging for a problem and forgets it. A migration leaves the Duplicator installer in the site folder. A new host rewrites the configuration file without DISALLOW_FILE_EDIT.
None of these change how the site looks, so nobody notices.
How it works.
Reading the settings
The agent reads the
wp-config.phpconstants and WordPress settings, without sending passwords or keys to the platform.WordPress rules
Every risky setting has a check with its own priority.
Fix
The result says what to write, for example
define('DISALLOW_FILE_EDIT', true);.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Should XML-RPC always be off?
No. Jetpack and some apps use it. That is why the check stays in the dashboard, without email: we tell you it is on, you decide.
Goes well with
- 169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShopHidden admins, risky settings, exposed databases and files, with what to do.
- The WordPress backdoors that survive a cleanupCron events, options with packed code, mu-plugins and hidden admins.
- Database user privileges: one hacked site shouldn't open the othersMySQL users with global rights, or that can see other databases.
- Security headers on your client sites: HSTS, CSP and the restHSTS, nosniff, framing, CSP, referrer and permissions policy, read from outside.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.